Examkin

Question

Difficulty: MediumAWS Network Services

A team is setting up a database subnet in an Amazon VPC and needs to block all inbound traffic from a specific malicious IP address before it reaches any resource within that subnet. Which AWS firewall feature should they configure to enforce this subnet-level, stateless traffic filtering?

  1. Network Access Control ListAnswer
  2. B
    Security group
  3. C
    VPC peering connection
  4. D
    AWS Transit Gateway

Answer

Network Access Control List
A Network Access Control List (NACL) is the correct choice because it functions as a stateless firewall at the subnet level and allows the creation of explicit deny rules to block specific IP addresses.

Step-by-Step Solution

1
Identify the scope and rule requirements.
The requirement specifies blocking traffic at the subnet level and filtering a specific IP address using a firewall control.
This helps determine whether an instance-level or subnet-level control is needed, and whether deny rules are supported.
2
Evaluate AWS firewall features against the requirements.
Network Access Control Lists (NACLs) are stateless, operate at the subnet level, and support explicit deny rules. Security groups are stateful, operate at the instance level, and support only allow rules.
Choosing the correct feature requires mapping the stateless and subnet-level characteristics of NACLs to the requirement of blocking an IP address before it enters the subnet.

Key Concept

Subnet-level stateless filtering using Network Access Control Lists (NACLs)
Estimated Time:1m 0s
Rate this question

Topics

AWS Network Services

More questions from this topic